Learn
AWS
Management & governance
CloudTrail

AWSGCP laterAzure later

CloudTrailAWS CloudTrail

Management & governanceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

A record of the actions taken in your AWS account by people, roles and services: who did what, to which resource, when and from where.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateLOWSysOps Administrator – AssociateHIGHSecurity – SpecialtyHIGH

Where CloudTrail takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Who did what, and when

CloudTrail records the actions taken by users, roles and AWS services in your account as events, whether they came from the console, the CLI, an SDK or the API. Each event says who acted, on which resource, when and from where.

Three ways to keep them. Event history shows the last 90 days of management events in each Region, free and there from the day the account is created. A trail delivers events to an S3 bucket, where they stay as long as you keep them. CloudTrail Lake stores them for SQL queries, but it stopped taking new customers on 31 May 2026.

Reach for it when

auditors ask who changed a security group
API activity must be kept for years
someone must be told when a particular API is called
unusual bursts of API calls or errors must be spotted

It is the wrong tool when

you want the CPU, latency or error rate of an application: that is CloudWatch
requests to a website must be filtered: that is WAF

Mental model

The visitor log at the front desk

The visitor log at a building's front desk. Every door opened and every key card used is written down with the person, the time and the door. The desk keeps the last 90 days on its own shelf; for longer, pages are sent to a vault, sealed so anyone can tell if one was changed or torn out.

A line in the visitor logone recorded actionEvent

The desk's own shelfthe last 90 days, at no chargeEvent history

Sending pages to the vaultdelivering events to S3Trail

Doors opened, locks changedoperations that manage resourcesManagement events

What is taken out of each roomoperations on the data insideData events

The seal on each pageproof that a file is unchangedLog file validation

How it works

Recorded, kept, checked

Events are recordedManagement events, such as creating a subnet or attaching a policy to a role, are recorded from the day the account exists.
Look back 90 daysEvent history lets you view, search and download them, one Region at a time.
Create a trailA trail made in the console records every enabled Region and delivers log files to an S3 bucket, about every 5 minutes.
Add what you needData events, Insights events and delivery to CloudWatch Logs are off until you choose them, and some are charged.

Event history: 90 daysmanagement events, free
Delivery: About 5 minuteson average, not guaranteed
Logged by default: Management eventsnot data or Insights events
First trail copy: Freeof management events, to S3
Digest files: Every hourwith validation turned on
Lake retention: Up to 3,653 daysabout 10 years

Event type
Was it a management event, recorded by default, or a data event, such as reading an S3 object, recorded only where a trail was told to?
How far back
Is it within 90 days, which event history covers, or older, which needs a trail's copies in S3?
Which Region
Event history is per Region; a multi-Region trail puts every enabled Region in one bucket.
Can it be trusted
With log file validation on, digest files show whether a log file was changed or deleted after delivery.

Pick a case to follow the question through each check.

Architecture

An audit trail for the organization

An organization trail records every account and delivers log files to one bucket, where Athena queries them, and sends events to CloudWatch Logs for alarms.

One trail for the whole organization. An organization trail, created from the management account or a delegated administrator, logs every member account to the same bucket, and the members cannot change or delete it.

Keep and protect the files. S3 Lifecycle rules decide how long log files stay; a trail made in the console encrypts them with a KMS key; validation shows whether any was altered.

Alarms on activity. Delivered to CloudWatch Logs, events can be counted by a metric filter, and an alarm can tell the security team when a particular call is made.

Query where they lie. Athena can search the log files in the bucket with SQL.

Security

Trusting the record

Log file validation hashes every log file with SHA-256 and signs an hourly digest file with RSA, so changing, deleting or forging a file cannot go unnoticed.

Encryption. A trail created in the console encrypts log and digest files with a KMS key; without SSE-KMS they are encrypted with S3 server-side encryption.

Organization trails are visible to member accounts, which cannot turn them off, change what they log, or delete them.

Global services. Events from IAM, AWS STS and CloudFront are recorded in US East (N. Virginia); a multi-Region trail captures them along with everything else.

Cost

How you are charged, not what it costs today

Event history is free, and so is the first copy of management events that a trail delivers to S3; you pay S3 for storing it.

Additional copies of management events are charged.

Data events and network activity events are charged by the number delivered.

Insights is charged by the events it analyses.

CloudTrail Lake charges for ingesting data, keeping it, and the data each query scans.

Prices change, so none are printed here. Check the CloudTrail pricing page on aws.amazon.com.

Comparison

Where events live, and which are recorded

Where	Holds	For how long	Choose it when
Event history	Management events, one Region at a time	90 days	A quick look back, at no charge
Trail	The events you select, from every Region	As long as the bucket keeps them	A lasting record, alarms and analysis
CloudTrail Lake	Events in a store you query with SQL	Up to 3,653 days	SQL across accounts, if you already use it

Event type	For example	Logged by default
Management	Creating a subnet, attaching a policy, signing in to the console	Yes
Data	GetObject and PutObject on S3 objects, invoking a Lambda function	No
Insights	Unusual rates of API calls or errors	No

Service	Answers
CloudTrail	Who did what in the account, when and from where
CloudWatch	How resources and applications are behaving

SAA traps

The phrase in the question, and what it means

who terminated the instance last weekCloudTrail event history

Ninety days of management events, free, in the Region where it happened.

keep a record of API activity for 7 yearsA trail to S3

Event history stops at 90 days.

who downloaded objects from a bucketS3 data events on a trail

Data events are not logged by default.

prove the audit logs were not tampered withLog file integrity validation

SHA-256 hashes and signed hourly digest files.

one trail for every account in the organizationAn organization trail

Members can see it, but not change or delete it.

record activity in every Region, not only the one in useA multi-Region trail

It covers every enabled Region, and the console creates trails that way.

alert the moment a particular API call is madeTrail to CloudWatch Logs, a metric filter and an alarm

CloudTrail itself raises no alarms.

spot an unusual burst of API callsCloudTrail Insights

It compares call and error rates with the account's normal pattern.

audit events must arrive within seconds of the callNot guaranteed

Log files arrive about every 5 minutes on average.

run SQL over CloudTrail logs in S3Athena

It can search the trail's log files where they are stored.

Scenario

Exam style, marked when you answer

A bank must keep a record of every API call in all Regions of its 30 AWS accounts for seven years, be able to detect whether any log file has been altered, and stop the administrators of each account from turning the logging off. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

Auditors need a record of every API call made in the account, kept in S3 for years and queried with SQL whenever they ask. What produces the record that lands in the bucket?

Pick a service belowS3· Audit bucket, kept for yearsAthena· Auditors' queries

Quick revision

The night before the exam

What: A record of actions in the account: who, what, when, where.
Event history: 90 days of management events, free, per Region.
Trail: To S3; every Region when created in the console.
Defaults: Management events only; data and Insights are extra.
Delivery: About every 5 minutes, not guaranteed.
Validation: SHA-256 hashes, signed digest files every hour.
Organization trail: Every member account; members cannot change it.
Alarms: Send to CloudWatch Logs, then filter and alarm there.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.